beth_analysis_graphing.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "source": [
    "# Imports"
   ],
   "metadata": {
    "collapsed": false
   }
  },
  {
   "cell_type": "code",
   "execution_count": 2,
   "outputs": [],
   "source": [
    "import sys\n",
    "import dill as pickle\n",
    "from math import ceil\n",
    "import pandas as pd\n",
    "# to save results to data directory\n",
    "module_path = '..'\n",
    "if module_path not in sys.path:\n",
    "    sys.path.insert(1, module_path)\n",
    "# increase displayed columns in jupyter notebook\n",
    "pd.set_option('display.max_columns', 200)\n",
    "pd.set_option('display.max_rows', 300)"
   ],
   "metadata": {
    "collapsed": false,
    "pycharm": {
     "name": "#%%\n"
    }
   }
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "outputs": [],
   "source": [
    "import logging\n",
    "import numpy as np\n",
    "import matplotlib.pyplot as plt\n",
    "\n",
    "import matplotlib\n",
    "matplotlib.use(\"pgf\")\n",
    "matplotlib.rcParams.update({\n",
    "    \"pgf.texsystem\": \"pdflatex\",\n",
    "    'font.family': 'serif',\n",
    "    'text.usetex': True,\n",
    "    'pgf.rcfonts': False,\n",
    "})\n",
    "\n",
    "# increase displayed columns in jupyter notebook\n",
    "pd.set_option('display.max_columns', 200)\n",
    "pd.set_option('display.max_rows', 300)\n",
    "\n",
    "# temporarily remove deprecation warnings\n",
    "import warnings\n",
    "warnings.filterwarnings(\"ignore\", category=DeprecationWarning)\n",
    "\n",
    "logging.basicConfig(format='%(asctime)s: %(message)s', datefmt='%m/%d/%Y %I:%M:%S %p')\n",
    "logger = logging.getLogger(\"TimeSeries\")\n",
    "logger.setLevel(logging.INFO)\n",
    "\n",
    "output_dir = 'beth_output'"
   ],
   "metadata": {
    "collapsed": false,
    "pycharm": {
     "name": "#%%\n"
    }
   }
  },
  {
   "cell_type": "markdown",
   "source": [
    "# Dataset"
   ],
   "metadata": {
    "collapsed": false
   }
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "outputs": [],
   "source": [
    "with open(f\"_data/BETH/data.pkl\", \"rb\") as fh:\n",
    "    df= pickle.load(fh)\n",
    "\n",
    "with open(f\"_data/BETH/model.pkl\", \"rb\") as fh:\n",
    "    outlier_model = pickle.load(fh)"
   ],
   "metadata": {
    "collapsed": false,
    "pycharm": {
     "name": "#%%\n"
    }
   }
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "outputs": [],
   "source": [
    "height = 4\n",
    "width = 5\n",
    "\n",
    "\n",
    "def plot_save_mp(outlier_model, file_name, s_index=0, e_index=-1, sci_index=False):\n",
    "    fig = plt.figure()\n",
    "    if e_index > 0: # Adjust for full dataset\n",
    "        s_index_mp = s_index - outlier_model.ts_size\n",
    "        e_index_mp = e_index - outlier_model.ts_size\n",
    "        local_range = range(s_index,e_index)\n",
    "    else:\n",
    "        s_index_mp = s_index\n",
    "        e_index_mp = e_index\n",
    "        local_range = list(range(0, len(outlier_model.max_val) - 1))\n",
    "    plt.plot(local_range, outlier_model.max_val[s_index_mp:e_index_mp], 'b--', label='max')\n",
    "    plt.plot(local_range, outlier_model.max_mean[s_index_mp:e_index_mp], 'y--', label=r'$\\mu$')\n",
    "    plt.plot(local_range, outlier_model.max_std_dev[s_index_mp:e_index_mp], 'g--', label=r'$\\sigma$')\n",
    "    if sci_index:\n",
    "        plt.ticklabel_format(axis=\"y\", style=\"sci\", scilimits=(3, 3))\n",
    "    plt.xlabel('Time (s)')\n",
    "    plt.ylabel('Matrix Profile Values')\n",
    "\n",
    "    first_detect = True\n",
    "    for i in outlier_model.anomalies:\n",
    "        if i in local_range:\n",
    "            if e_index < 0:\n",
    "                i = i - outlier_model.ts_size # Adjust for full dataset\n",
    "            if first_detect:\n",
    "                plt.axvline(x=i, color='r', linestyle='-', label='detect')\n",
    "                first_detect = False\n",
    "            else:\n",
    "                plt.axvline(x=i, color='r', linestyle='-', )\n",
    "\n",
    "    plt.legend(loc=0)\n",
    "\n",
    "    plt.show()\n",
    "    fig.set_size_inches(w=width, h=height)\n",
    "    plt.savefig(file_name)"
   ],
   "metadata": {
    "collapsed": false,
    "pycharm": {
     "name": "#%%\n"
    }
   }
  },
  {
   "cell_type": "code",
   "execution_count": 6,
   "outputs": [],
   "source": [
    "def plot_save_freq(data, file_name, s_index=0, e_index=-1, sci_index=False, height=4, width=5):\n",
    "    fig = plt.figure()\n",
    "    plt.plot(data[s_index:e_index])\n",
    "    plt.xlabel('Time (s)')\n",
    "    plt.ylabel('User ID')\n",
    "    if sci_index:\n",
    "        plt.ticklabel_format(axis=\"y\", style=\"sci\", scilimits=(3, 3))\n",
    "\n",
    "\n",
    "    plt.show()\n",
    "    fig.set_size_inches(w=width, h=height)\n",
    "    plt.savefig(file_name)"
   ],
   "metadata": {
    "collapsed": false,
    "pycharm": {
     "name": "#%%\n"
    }
   }
  },
  {
   "cell_type": "code",
   "execution_count": 7,
   "outputs": [],
   "source": [
    "outlier_key = \"userId\"\n",
    "data_f_c = df[outlier_key]"
   ],
   "metadata": {
    "collapsed": false,
    "pycharm": {
     "name": "#%%\n"
    }
   }
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/var/folders/rt/82pssgq96l9d_s3skbv32z5m0000gn/T/ipykernel_30577/3686468736.py:10: UserWarning: Matplotlib is currently using pgf, which is a non-GUI backend, so cannot show the figure.\n",
      "  plt.show()\n"
     ]
    }
   ],
   "source": [
    "height = 4\n",
    "width = 6\n",
    "\n",
    "plot_save_freq(data_f_c, f'{output_dir}/base_sig_{outlier_key}_all.pgf', sci_index=False, height=height, width=width)"
   ],
   "metadata": {
    "collapsed": false,
    "pycharm": {
     "name": "#%%\n"
    }
   }
  },
  {
   "cell_type": "code",
   "execution_count": 9,
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/var/folders/rt/82pssgq96l9d_s3skbv32z5m0000gn/T/ipykernel_30577/2610879682.py:36: UserWarning: Matplotlib is currently using pgf, which is a non-GUI backend, so cannot show the figure.\n",
      "  plt.show()\n"
     ]
    }
   ],
   "source": [
    "height = 4\n",
    "width = 6\n",
    "\n",
    "plot_save_mp(outlier_model, f'{output_dir}/mp_hist_{outlier_key}.pgf', sci_index=True)"
   ],
   "metadata": {
    "collapsed": false,
    "pycharm": {
     "name": "#%%\n"
    }
   }
  },
  {
   "cell_type": "code",
   "execution_count": 10,
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "04/22/2022 12:53:37 PM: [11000, 213090, 237204, 485354, 787618, 816542]\n",
      "/var/folders/rt/82pssgq96l9d_s3skbv32z5m0000gn/T/ipykernel_30577/1796287077.py:12: UserWarning: Matplotlib is currently using pgf, which is a non-GUI backend, so cannot show the figure.\n",
      "  plt.show()\n"
     ]
    }
   ],
   "source": [
    "# Results plot\n",
    "fig = plt.figure()\n",
    "data_test = df.copy()\n",
    "plt.plot(data_test[\"evil\"] )\n",
    "# plt.title(f\"Detection Method: Anomaly\")\n",
    "logger.info(outlier_model.anomalies)\n",
    "for i in outlier_model.anomalies:\n",
    "    plt.axvline(x=i,color='r')\n",
    "plt.xlabel(r'time')\n",
    "plt.ylabel(r'evil')\n",
    "\n",
    "plt.show()\n",
    "\n",
    "fig.set_size_inches(w=width, h=height)\n",
    "plt.savefig(f'{output_dir}/outlier_result_evil_{outlier_key}.pgf')"
   ],
   "metadata": {
    "collapsed": false,
    "pycharm": {
     "name": "#%%\n"
    }
   }
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "04/22/2022 12:53:37 PM: [11000, 213090, 237204, 485354, 787618, 816542]\n",
      "/var/folders/rt/82pssgq96l9d_s3skbv32z5m0000gn/T/ipykernel_30577/95991604.py:12: UserWarning: Matplotlib is currently using pgf, which is a non-GUI backend, so cannot show the figure.\n",
      "  plt.show()\n"
     ]
    }
   ],
   "source": [
    "# Results plot\n",
    "fig = plt.figure()\n",
    "data_test = df.copy()\n",
    "plt.plot(data_test[\"sus\"] )\n",
    "# plt.title(f\"Detection Method: Anomaly\")\n",
    "logger.info(outlier_model.anomalies)\n",
    "for i in outlier_model.anomalies:\n",
    "    plt.axvline(x=i,color='r')\n",
    "plt.xlabel(r'time')\n",
    "plt.ylabel(r'sus')\n",
    "\n",
    "plt.show()\n",
    "\n",
    "fig.set_size_inches(w=width, h=height)\n",
    "plt.savefig(f'{output_dir}/outlier_result_sus_{outlier_key}.pgf')"
   ],
   "metadata": {
    "collapsed": false,
    "pycharm": {
     "name": "#%%\n"
    }
   }
  },
  {
   "cell_type": "code",
   "execution_count": 17,
   "outputs": [
    {
     "name": "stderr",
     "output_type": "stream",
     "text": [
      "/var/folders/rt/82pssgq96l9d_s3skbv32z5m0000gn/T/ipykernel_30577/1499432866.py:94: UserWarning: Matplotlib is currently using pgf, which is a non-GUI backend, so cannot show the figure.\n",
      "  plt.show()\n"
     ]
    }
   ],
   "source": [
    "# adapted from https://stackoverflow.com/questions/44951911/plot-a-binary-timeline-in-matplotlib?answertab=modifieddesc#tab-top\n",
    "width = 5.5\n",
    "height = 2.5\n",
    "\n",
    "fault_key = \"evil\"\n",
    "#create a time series s with dates as index and 0 and 1 for events\n",
    "my_column_changes = df[fault_key].shift() != df[fault_key]\n",
    "\n",
    "events = df[my_column_changes]\n",
    "\n",
    "fault_start = events.loc[events[fault_key] == 1].index.tolist()\n",
    "fault_end = events.loc[events[fault_key] == 0].index.tolist()\n",
    "\n",
    "no_fault_no_ends = fault_end [1:]\n",
    "\n",
    "times_faults = list(zip(fault_start, no_fault_no_ends))\n",
    "fault_start.append(df.index[-1]) # needs last element to finalize graph\n",
    "times_no_faults = list(zip(fault_end ,fault_start))\n",
    "\n",
    "bar_green =  list(map(lambda x: (x[0], x[1] - x[0]) , times_no_faults))\n",
    "bar_red = list(map(lambda x: (x[0], x[1] - x[0]) , times_faults))\n",
    "\n",
    "fault_key = \"sus\"\n",
    "#create a time series s with dates as index and 0 and 1 for events\n",
    "my_column_changes = df[fault_key].shift() != df[fault_key]\n",
    "\n",
    "events = df[my_column_changes]\n",
    "\n",
    "fault_start = events.loc[events[fault_key] == 1].index.tolist()\n",
    "fault_end = events.loc[events[fault_key] == 0].index.tolist()\n",
    "\n",
    "no_fault_no_ends = fault_end [1:]\n",
    "\n",
    "times_faults = list(zip(fault_start, no_fault_no_ends))\n",
    "fault_start.append(df.index[-1]) # needs last element to finalize graph\n",
    "times_no_faults = list(zip(fault_end ,fault_start))\n",
    "\n",
    "bar_green2 =  list(map(lambda x: (x[0], x[1] - x[0]) , times_no_faults))\n",
    "bar_red2 = list(map(lambda x: (x[0], x[1] - x[0]) , times_faults))\n",
    "\n",
    "\n",
    "fig, ax = plt.subplots(figsize=(width, height))\n",
    "\n",
    "\n",
    "red_tuple = (0,bar_red2[5000][0])\n",
    "bar_green2 = bar_green2[5001:]\n",
    "bar_red2 = bar_red2[5000:]\n",
    "\n",
    "bar_red2.insert(0,red_tuple)\n",
    "\n",
    "plt.broken_barh(bar_green2, (0.25, 1), color=\"lightgreen\")\n",
    "plt.broken_barh(bar_red2, (0.25, 1), color=\"lightsalmon\")\n",
    "plt.broken_barh(bar_green, (-1, 1), color=\"lightgreen\")\n",
    "plt.broken_barh(bar_red, (-1, 1), color=\"lightsalmon\")\n",
    "\n",
    "ax.vlines(\n",
    "    outlier_model.anomalies,\n",
    "    ymin=-1,\n",
    "    ymax=1.25,\n",
    "    linewidth=2,\n",
    "    colors='r',\n",
    "    linestyle='--', label='detection')\n",
    "\n",
    "#Time line\n",
    "timeline_y = -0.5\n",
    "ax.axhline(\n",
    "    timeline_y,\n",
    "    linewidth=1,\n",
    "    linestyle='--',\n",
    "    color='black')\n",
    "\n",
    "#Feature line\n",
    "feature_line_y = 0.75\n",
    "ax.axhline(\n",
    "    feature_line_y,\n",
    "    linewidth=1,\n",
    "    linestyle='--',\n",
    "    c='black')\n",
    "\n",
    "ax.legend()\n",
    "#format axes\n",
    "ax.margins(0)\n",
    "ax.set_yticks([ feature_line_y,timeline_y], labels=['Suspicious', 'Harmful'])\n",
    "# Remove ticks on y-axis\n",
    "\n",
    "ax.tick_params(left = False)\n",
    "ax.ticklabel_format(axis=\"x\", style=\"sci\", scilimits=(0,0))\n",
    "ax.set_xlabel('Time (s)')\n",
    "\n",
    "# ax.set_ylabel('Ground Truth')\n",
    "\n",
    "plt.yticks(rotation = 45)\n",
    "plt.tight_layout()\n",
    "plt.show()\n",
    "\n",
    "fig.set_size_inches(w=width, h=height)\n",
    "plt.savefig(f'{output_dir}/outlier_result_{outlier_key}.pgf')"
   ],
   "metadata": {
    "collapsed": false,
    "pycharm": {
     "name": "#%%\n"
    }
   }
  }
 ],
 "metadata": {
  "interpreter": {
   "hash": "d9d18e9f29cc76176cc64cecda10b08503df27bbeb68d46276fb666f16272d10"
  },
  "kernelspec": {
   "name": "python3",
   "language": "python",
   "display_name": "Python 3 (ipykernel)"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.8.12"
  },
  "toc-autonumbering": true
 },
 "nbformat": 4,
 "nbformat_minor": 5
}